feat: support Flamingo matching in browser WASM

[soamdesai-tfh]

WalletKit currently excludes Flamingo from WASM. This makes the existing three-way matcher callable from a browser through JavaScript/TypeScript bindings and a dedicated worker, with attestation verification and encryption kept in Rust.

• Enable the Flamingo module on WASM and adapt its async boundary.
• Pin browser-compatible dependency commits through normal Cargo resolution, so plain Cargo, Nix, Docker, and CI use the same sources with --locked. No bootstrap script or local patches are required.
• Add automated browser-test fixtures and CI coverage for the release package. Dependency unit tests run in their owning repositories' CI, avoiding private biometric-model dependencies in WalletKit's job.

Dependency changes are under review in worldcoin/pontifex#47 and worldcoin/flamingo#116.

Validation

Standard locked WASM check (including embedded-key configuration), release build, and JavaScript package build passed locally. Cargo.lock remained unchanged. The 2 Pontifex, 5 Flamingo, and 8 Chromium/WebKit browser tests passed against the pinned sources. Native suites passed during the initial implementation. Formatting, shell checks, and dependency-source checks passed.

Remaining integration

Live staging-enclave matching and actual iOS Safari testing have not been performed. Replace the Git pins with compatible crate releases before publishing WalletKit. This change covers the existing three-way operation; selfie enrollment, two-way matching, recovery, and World ID proof generation are separate work.

---

Note

High Risk
Introduces browser-facing biometric matching and verifier traffic with git-pinned crypto dependencies; mistakes in attestation pinning or error handling could affect trust boundaries.

Overview
Adds browser-callable Flamingo three-way matching by compiling attestation verification and encrypted matching in Rust/WASM, with a dedicated worker so match tokens stay off the parent page.

Rust / deps: New walletkit-web crate (wasm-bindgen) exports FlamingoClient, typed errors, and opaque verified-match handles. walletkit-core now builds the flamingo module on wasm32 (including async_trait(?Send) and skipping native-only unit tests). Flamingo verifier crates and pontifex move from crates.io to pinned git revisions; deny.toml whitelists those sources and Cargo.lock reflects the graph.

JS / CI: web/ adds build.sh, a FlamingoWorker RPC client, a test HTTP fixture, and Playwright coverage in Chromium and WebKit. The WASM CI job uses --locked, asserts Cargo.lock is unchanged after check, builds the web package, and runs npm test.

^{Reviewed by Cursor Bugbot for commit 2a4b2b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-17T21:56:25.901751Z	c4d3f7a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[soamdesai-tfh]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c4d3f7a696

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Route supported WASM builds through the dependency patches

When invoking the supported nix/build-wasm.sh or the WASM-shell command documented in nix/README.md, this newly ungated module selects the published Flamingo/Pontifex crates, while their required WASM RNG and clock support exists only in the temporary patches supplied by web/cargo.sh. Neither supported entry point bootstraps or applies those patches, so a fresh checkout's standard WalletKit WASM build now fails; route all documented WASM builds through the bootstrap/wrapper or make the patched dependencies part of the normal dependency setup.

AGENTS.md reference: AGENTS.md:L5-L7

Useful? React with 👍 / 👎.